A User Centric Security Model for Tamper-Resistant Devices

A.5 Just-Fast-Keying (JFK) Protocol
The SP will decrypt the message and a successful decryption provides the key authentication.
It then veries the signature and process the transaction.
A.5 Just-Fast-Keying (JFK) Protocol
Aiello et al. [178] proposed two variants of JFK protocol, with dierence based on who
initiate the protocol. In this thesis, we refer to JFKi that provides identity protection
for initiator (e.g. smart card) even against active attacks. In the JFKi, the smart card
initiates the session that is described below:
JFKi-1. SC → SP : h(N SC )||g SC ||ID S ′
The initiator (SC) generates a random number (N SC ) and sends its hash along with Die-
Hellman exponential (g SC ) appended with requirement of the SC about authentication
information that the SP should use in subsequently messages. The requirement of the SC
is indicated by ID S ′
JFKi-2. SP : S SP = Sign SP (g SP ||grpinfo R )
SP : SID = f mkSP (g SP ||N SP ||h(N SC )||IP SC )
SP → SC : h(N SC )||N SP ||g SP ||grpinfo R ||ID SP ||S SP ||SID
In response, the SP also generates a random number and Die-Hellman exponentials. The
SP then sends the h(N SC ) along with the grpinfo R and ID SP . The grpinfo R indicates
to the SC the set of Die-Hellman groups supported by the SP. The ID SP provides the
authentication information of SP that was request by the SC in message one. Furthermore,
the SP generates a signature on the generated g SP and grpinfo R , and nally append the
session identier (SID) to safeguard against possible DoS attacks.
JFKi-3. SC : K = (g SP ) SC
SC : k US = f K (h(N SC )||N SP || ′′ 1 ′′ )
SC : mk US = f K (h(N SC )||N SP || ′′ 2 ′′ )
SC : mE = e kUS (U i ||Sign SC (h(N SC )||N R ||g SC ||g SP ||S i ))
SC → SP : N SC ||N SP ||g SC ||g SP ||mE||f mkSC−SP (mE)||SID
The SC generates the session encryption and MAC keys from the shared secret (K). The SC
then generates a message including identities of communicating entities, random numbers
generated during the session, and Die-Hellman exponentials. The SC then signs this
message and later encrypts it. The encrypted message is then MACed and sent to the SP.
JFKi-4. SP : mE = e kUS (Sign SP (h(N SC )||N R ||g SC ||g SP ||U i ))
SP → SC : mE||f mkSC−SP (mE)
In response the SP generates a signature that includes random numbers, Die-Hellman
exponentials and identity of the SC. The signed message is then encrypted and MACed
before sending it to the SC.
235